Secure Deterministic Communication Without Entanglement 
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We propose a protocol for deterministic communication that does not make use of entanglement. 
It exploits nonorthogonal states in a two-way quantum channel attaining significant improvement 
of security and efficiency over already known cryptographic protocols. The presented scheme, be- 
ing deterministic, can be devoted to direct communication as well as to key distribution, and its 
experimental realization is feasible with present day technology. 
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In a recent paper Bostrom and Felbinger presented 
a scheme to have "Secure Deterministic Communication 
using Entanglement" . The idea is an original revisiting of 
the "Quantum Dense Coding" 0. They called the pro- 
tocol "Ping-Pong" (PP) for its peculiarity of a "forward 
and backward" use of the quantum channel. With re- 
spect to Bennett and Brassard's scheme (BB84) the 
main advantage of PP is its deterministic nature, that 
permits Quantum Direct Communication (QDC) as well 
as Quantum Key Distribution (QKD). Unfortunately it 
was proved to be not completely secure jj, la] . 

We describe here a communication protocol that com- 
bines the main advantages of PP and BB84, while avoid- 
ing their drawbacks, and we termed it PP84 [||. The 
general idea is summarized in Fig^ A character, tradi- 
tionally called Bob, prepares a qubit in one of the four 
randomly chosen states |0), |1) (eigenstates of Pauli op- 
erator Z), |+), |— ) (eigenstates of Pauli operator X), 
and sends it to his counterpart Alice. With probability 
(c) Alice measures the prepared state (control mode) or, 
with probability (1 — c), she uses it to encode a bit (en- 
coding mode). After that she will send the qubit back 
to Bob. Encoding is represented by a transformation on 
qubit state rather than by qubit state itself: identity op- 
eration / encodes 0, while operation iY = ZX encodes 
1. Notice that iY acts as a spin- flip on all the beginning 
states: 
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In this way Alice does not need to know the incoming 
state to perform the encoding. In turn Bob can easily 
decode Alice's message by measuring the qubit in the 
same basis he prepared it. This feature makes the pro- 
tocol deterministic: no qubits are discarded because of a 
wrong choice of the basis. To make a QDC it suffices that 
Alice performs transformations according to the message 
she wants to send out, while for a QKD the sequence 
of transformations will be random. Moreover the ab- 
sence of any public discussion concerning qubit basis in 
the encoding- decoding procedure gives an eavesdropper 
(Eve) no classical information about qubit state, prevent- 



FIG. f : PP84 scheme 



ing powerful attacks based on this strategy. 

To guarantee security of PP84, Alice has to measure 
the qubit with a probability c ^ by randomly choos- 
ing a basis (Z or X), as in BB84. After that she will 
send qubit back to Bob. He, after publicly declaring the 
receipt of the qubit, measures it as exactly would do if 
Alice had encoded it (actually, he doesn't still know Al- 
ice's choice). At this point Alice reveals publicly whether 
she measured (and in which basis) or not, and a public 
debate on results is settled with Bob in the former case. 
Notice that if Eve is not on the line a perfect "double" 
correlation (on the forward and backward paths) of mea- 
surement results must be found by legitimate users. 

The "run-by-run" protocol just described realizes a 
QDC, which is more demanding on security. QKD easily 
follows from it by deferring all public discussions at the 
end of the whole transmission. 

Let us introduce the question of security of PP84 by 
a simple eavesdropping strategy. Suppose Eve randomly 
decides a basis, Z or X, along which performing projec- 
tive measurements on the traveling qubit, both on for- 
ward and backward path. She can guess the right basis 
with probability 1/2, and in this case she is not revealed 
at all. If otherwise Eve chooses the wrong basis she still 
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has a probability of 50% to evade detection at point E\ 
and 50% at point E^ giving in the whole a 25% of pos- 
sibility to evade detection. This means that Alice and 
Bob's double test reveals Eve with average probability 
equal to: (0 + 3/4)/2 = 3/8 = 37.5%. Remarkably, this 
value is greater than the one obtained in BB84 (25%) for 
the same eavesdropping strategy. To extend the argu- 
ment to general attacks we follow the line sketched in |7j 
but with some relevant differences. 

Given the four states prepared by Bob, and Eve's an- 
cillary states |e), we can write the most general operation 
Eve can do on traveling qubit as: 
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Ancillary states are neither orthogonal nor normalized; 
states with tilde are instead normalized. The following 
conditions make the transformations (|5J unitary: 



(eoo|eoo) + (eoi|eoi) = F + D = 1 
(eioleio) + (enkii) = D + F = 1 
(eoo|eio) + (eoiku) = 



(3) 



We can set, without loss of generality: (eool^oi) = 
(eioku) = (^ookio) = (^oiku) = 0. Furthermore, we 
specify the angles between nonorthogonal vectors as: 



(£oo £11) = cos a; , 



(eoikio) = cosy 



(4) 



with < x , y < 7r/2. Here, we don't fix values of the 
parameters we introduced. In Q symmetry arguments 
lead to assume F = (eoo| £ oo) = ( e ++| e ++)- This rea- 
soning is not applicable in our case: the absence of a 
classical discussion during the encoding-decoding proce- 
dure prevents Eve from waiting for the basis revelation, 
thus forcing her to break the symmetry by deciding the 
measurement basis. 

At point E% Eve performs an attack similar to that at 
point Ei, but with fresh ancillac I77) (hence new param- 
eters F' and D'), 
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At the end of transmission Eve will measure e and 77 ancil- 
lae and, by comparing results, she will gain information. 



This strategy represents the most general attack Eve can 
perform in a single run, if we do not allow her to create 
coherence in some way between forward and backward 
paths; for this reason we term it "incoherent" , referring 
to the other possibility as "coherent". Within this kind 
of attack we must recover the optimal measure Eve can 
do i.e. we must maximize Alice and Eve's mutual infor- 
mation (Tae) minimizing detection probability (Pd)- 

From transformations © and conditions © we can 
evaluate the probability that Eve is not detected in the 
forward path, after her £i-attack: 



P nd {\0)) = (eookoo} 
Pnd(\l)) = <en|eii) 
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Similar arguments hold for the backward path, after 
i?2-attack, with primed parameters replacing not-primed 
ones. The probability that Eve is not detected after a 
whole run is then the product of the two partial probabil- 
ities; by taking its complement we obtain the probability 
to detect Eve. Averaging it over all input states we get: 

P d = (l/8){7 - 4FF' - F cosx - D cosy - F' cos 3/ 

— D' cos y' — FF' cos x cos x' — FD' cos x cos y' 

— DF' cosy cosx' — DD' cos y cos y'} (7) 
It is possible to show |8j that Pd takes the minimum 

d = min P d = [1 - (1 + cosx) (1 + cosx') /4] /2 (8) 

for F = F' = 1; this condition represents the best Eve 
can do to conceal her presence. The maximum value 
d = 3/8 is obtained when x — x' — tt/2, corresponding, 
as we will see, to Eve's maximum information. 

If Alice and Bob are going to make a QDC we can eval- 
uate the probability that Eve can steal n bits of full infor- 
mation without being detected as (1 — c) n /[l — c(l — d)] n . 
It turns out, for example, that if c = 1/2 Eve has a proba- 
bility of about 7.8% to successfully eavesdrop 1 byte (i.e. 
8 bits) of full information and about 0.6% to eavesdrop 2 
bytes. Increasing the value of c increases security of the 
protocol, but at the expense of the transmission rate. 

If instead Alice and Bob are going to make a QKD 
then the argument is a little bit more complicated. To 
evaluate Iae let us write Bob's initial state as |\&) = 
S Q =o 1 \oi). Now, suppose Alice performs identity be- 
tween the two Eve's attacks: 
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The ancillary states involved in this operation are: 



koodoo} , koo,?7oi} j |eoi,f?io) , l^ouVn) 
kio,W , kio,?7oi} , |en,W , IsiuVn) (1°) 
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If, instead, Alice performs a flip we have: 

|*>|e>to>^X;C„X>>|e«0>|»?>3 

a p 

H c " H It) ka/s) |»7(/3©i) 7 ) 

and ancillary states involved are: 

I £oo, Vw) , koo, Vn) i koi, W , | £oi. Vox) 
I £io, ?7io) , kio, ?7ii) , kn, W , |£n, Vol) 



(11) 



(12) 



To acquire information from states 1)10(1 and 112JI Eve 
must measure both her ancillae. Keeping in mind or- 
thogonality relations 10 and following, we see that the 
best way to do that is to distinguish orthogonal subspaces 
before, and then nonorthogonal states within them. The 
probability to correctly distinguish between two states 
with scalar product cosx is (1 + sin a;) / 2 |9j . Observing 
states (| 1 Oft and l|12(l we can notice that if Eve mistakes 
to identify her first ancilla (e states) then she guesses 
wrong Alice's operation, since she flips from states 1 )10(1 
to ((12(1 or viceversa. The same is true if she guesses right 
e state but mistakes rj state. Nevertheless, if she mistakes 
twice, then with the first error she misinterprets ((10(1 with 
((12(1 and with the second error she compensates the first, 
eventually guessing right Alice's operation. This lead to a 
lengthy expression of Iae as a function of the six param- 
eters describing ancillae states, but it can be simplified 
recalling that Eve wants to keep the Pd as low as possi- 
ble, and so condition F = F' = 1 applies. In this case 
Eve's strategy is optimal and Iae becomes: 

Tab = 1 - /i [(1 + sin x sins')/ 2 ] ( 13 ) 

where ft(-) indicates the Shannon binary entropy [1(1 ]. 

We are now in the position to compare relevant quan- 
tities we have calculated, in particular Eq. JSJ) for Pd and 
Eg. ((13(1 forZ^. Unfortunately, both equations are func- 
tions of x and x' thus preventing us to write Iae as a 
function of Pd- However, the following lemma holds: 

Lemma. The optimal Eve incoherent attack consists in 
a balanced one for which x = x' . 

This lemma can be justified with the following qualita- 
tive argument [8j . The orthogonality Eve imposes on her 
ancillae is somewhat related to the information she can 
extract from the qubit: the more orthogonal they are, 
the higher is the information gained. If she sets x > x\ 
the ancillae e will be more orthogonal than ancillae ry, 
and this entails a loss of information when going from 
the forward to the backward path. If she sets x < x' we 
can argue the reverse. 

The above lemma allows us to write Pd © as: 



0.8 



0.6 



0.4 



0.2 



0.05 0.1 0.15 0.2 0.25 0.3 0.35 



d 



FIG. 2: PP84 Security: Information vs Detection Proba- 
bility. The descent curve represents Alice and Bob mutual 
information Tab- The crescent curves represent Alice and 
Eve mutual informations (Iae dashed line, J A °^ nd solid line). 



By inverting this relation and substituting it into Eq. 1(131) 
we can express the information Iae as function of Pd'- 



Iai 



1 



ft | 2 - (2Vl -2d- if h\ 



(15) 



It is easy to see that the maximum of information, Iae = 
1, corresponds to a detection probability d — 37.5%. This 
implies that projective attacks described above are a kind 
of optimal incoherent attacks. Iae as a function of Pd 
is shown in Fig [5] For a QKD to be secure a comparison 
between Alice and Eve's mutual information and Alice 
and Bob's one must be settled; we must then evaluate 
the amount of information Bob has access to. Also in 
these calculations we must set F = F' = 1, because Bob 
receives a perturbed state according to Eve's choice of 
minimizing the Pd- So, with this condition, the proba- 
bility that Bob makes a right guess on Alice's transfor- 
mation after preparing |+) or |— ), and Eve measures in 
the basis |eo,i) , l^o.i)' i s ^0,1 = (1 + cos x cos x') /2. The 
probability that Bob makes a right guess on Alice's trans- 
formation, after preparing the same states and Eve mea- 
sures in the basis |£+,-) , | »?+,-) is P+- = 1- Analogous 
results hold if Bob prepares states |0) or |1). Averaging 
the information corresponding to Fq,i and to P+,-, and 
using the above Lemma we get: 



I AB = 1 - (l/2)ft [(1 + cos 2 x) /2] 



(16) 



(1/2) - (1/8) (Id - cos x) 



(14) 



Eq. ((16|) can be written as function of Pd by inverting, 
as for Iae, Ea. lfHjl . The result is shown in Fig[21 We 
notice that minimum Bob's information is 1/2, because 
in half cases Eve doesn't perturb the channel at all. Nev- 
ertheless, if we had used symmetry conditions discussed 
after Eq. (0} we would have obtained Iae going to zero. 
The intersection of Iab and Iae determines the safety of 
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the protocol for QKD. It results that the PP84 is secure 
against a general incoherent attack provided d < 23%. 

So far we have considered incoherent attacks and eval- 
uated relevant quantities like detection probability, Eve's 
information and Bob's information. What is about co- 
herent attacks? The most general coherent attack can be 
written as a transformation on 64 states of the form: 

1°) l £ oo) 1 17) |0) [| £ oo) hoooooo) + koi) 1 17001000) 
+ kio) |%ioooo) + kn) honooo)] + 
+ I 1 ) [l £ oo) hiooooo) + |e<n) hioiooo) 
+ kio) hnoooo) + |eix) k/111000)] 

|i)koo)h) ->... 

i (17) 

because the attack at point E2 includes also the resulting 
state of the first ancillae. This can create coherence be- 
tween forward path and backward one, and Eve can take 
advantage of it. Despite of that the most general expres- 
sion for detection probability remains the one found for 
incoherent attacks, given by Eq. (T^ , because it is ob- 
tained when Alice decides to measure, and her measure 
breaks any coherence Eve could have created. Moreover, 
we notice that the first ( "translucid" [llj]) attack at point 
Ei is the most general Eve can perform on the forward 
path, and so it must be the same for any kind of com- 
plete attack. This arguments permit us to bound the 
information Eve can acquire in any attack, coherent or 
not. We simply put together a Pd equal to d and a value 
for Iae equal to the one Eve would obtain by setting 
x' = tt/2 in Eq.O: l b ^ nd = 1 - h[(l + sinx)/2]. It 
is clear that we have overestimated Eve's potential infor- 
mation gain or, the same, underestimated P4. Also this 
result is shown in Fig|2J We obtain in this way the very 
lower bound for security of PP84, namely d < 18%. No- 
tice that it is still greater than the one found in similar 
circumstances (individual attacks on a lossless channel) 
for BB84 (d < 15%) 7]. We believe that these results, 
together with the introductory remarks on attacks based 
on classical information exchange during the encoding- 
decoding procedure, demonstrate the safety of PP84. 

We would also like to briefly describe the behavior of 
PP84 when losses are present on the quantum channel. 
Two aspects of this question must be addressed: security 
against losses-based attacks and efficiency of transmis- 
sion. As far as the former is concerned the risk is that 
an almighty Eve could substitute an imperfect channel 
with a perfect one and conceal her attacks behind losses 
interpreted as natural by Alice and Bob. This possibility 
exploits the lack of symmetry of Alice control (l^l. 
and is not effective in our case. We have also consid- 
ered more subtle attacks based on a kind of "quantum 
nondemolition strategy" by Eve, but Alice and Bob can 
always detect them by comparing losses rate pertaining 
to control mode runs and encoding mode ones. 



As far as efficiency of transmission is concerned the im- 
plicit assumption is that losses are not due to an eaves- 
dropper, but only to an imperfect channel. Accord- 
ingly to Ref.01 the theoretical efficiency of a crypto- 
graphic protocol for QKD is given by the formula £ — 
b s / (qt +bt), where b s is the expected number of secret 
bits received by Bob, qt is the number of transmitted 
qubits on the quantum channel, and bt is the number 
of transmitted bits on the classical channel. Since in 
PP84 no classical information is needed in the encoding- 
decoding procedure we have b t = 0, that entails £ = 1 
(while for BB84 £ = 1/4). As far as practical efficiency 
is concerned we refer to |l4) . In our protocol a qubit, 
represented for instance by the polarization of a photon, 
is traveling for a distance 2L, being L the separation 
between Alice and Bob. If V is the probability that a 
photon is transmitted over the distance L, we have a to- 
tal probability V 2 to transmit it over 2L. The practical 
efficiency can then be evaluated as £' = £V 2 . For BB84 
the photon only travel for a distance L, thus £' = V/A. 
Comparing the two protocols, we obtain that if V > 25% 
then the most efficient scheme is just the PP84. 

In conclusion, we have presented a cryptographic pro- 
tocol which embeds peculiarities of BB84 and PP proto- 
cols, allowing direct communication as well as key dis- 
tribution. It has been proved asymptotically secure in 
the former case and secure against general attacks in the 
latter case, admitting a greater quantum bit error rate 
with respect to other known protocols. It is more efficient 
than other schemes when losses are taken into account, 
whilst allowing easier experimental realization. 

Acknowledgements. We acknowledge useful discussions 
with G. Di Giuseppe and S. Pirandola. One of us (M.L.) 
would like to thank his parents for funding. 



[1] K. Bostrom and T. Felbinger, Phys. Rev. Lett. 89, 
187902 (2002). 

[2] C. H. Bennett and S. J. Wiesner, Phys. Rev. Lett. 69, 
2881 (1992). 

[3] C. H. Bennett and G. Brassard, Proc. Int. Conference 
on Computers, Systems and Signal Processing (Indian 
Institute of Science, Bangalore, India, 1984). 

[4] Qing-Yu Cai, Phys. Rev. Lett. 91, 109801 (2003). 

[5] A. Wojcik, Phys. Rev. Lett. 90, 157901 (2003). 

[6] A deterministic communication protocol as a special case 
of BB84 has recently been presented by Qing-Yu Cai and 
Bai-Wen Li, Chin. Phys. Lett. 21, 601 (2004). 

[7] N. Gisin, et at, Rev. Mod. Phys. 74, 145 (2002). 

[8] The detailed calculations will be presented elsewhere for 
space reasons. 

[9] A. Peres, Quantum Theory: Concepts and Methods, 

(Kluwer, Dordrecht, 1993). 
[10] M. Nielsen and I. L. Chuang, Quantum Computation and 

Quantum Information (Cambridge Univ. Press 2000). 
[11] A. K. Ekert, et al. Phys. Rev. A 50 1047 (1994) 
[12] A. Wojcik, arXiv: quant-ph/0405035 



■5 



[13] A. Cabello, Phys. Rev. Lett. 85, 5635 (2000) 

[14] I. P. Degiovanni, et ai, Phys. Rev. A 69, 032310 (2004). 



